Add more constraints to S4U2Self processing

Add more constraints to S4U2Self processing

Of the eight possible combinations of local or cross TGT, local or
non-local user, and local server or referral, four are valid.  The
previous commit rejects two of the invalid cases (local TGT and
referral, with local or non-local user).  Document the four valid
cases and reject the remaining two invalid combinations.

[ghudson@mit.edu: rewrote commit message; added comment documenting
valid combinations; adjusted style and comments]

ticket: 8748 (new)